Access Control and Security VCP-DCV Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A vSphere administrator needs to create a custom role for the 'db-admins' group that allows them to manage virtual machines, including power operations, snapshots, and the ability to add or remove virtual disks. The administrator wants to base this on an existing role to save time. Which existing role should be cloned and modified?

   • AVirtual machine administrator
   • BVirtual machine power user
   • CReadOnly
   • DResource pool administrator
   Reveal Solution Discussion Select an answer first
2. 7application · easy

   A vSphere administrator wants to grant the 'helpdesk' group the ability to view the status of virtual machines and their resource usage, but NOT to make any changes. The helpdesk team should only see VMs in the 'Production' folder. Which built-in role should be assigned to the group on the 'Production' folder?

   • AVirtual machine user
   • BReadOnly
   • CAdministrator
   • DVirtual machine power user
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   Why is it recommended to avoid assigning permissions directly to individual users in vSphere?

   • AIt prevents the use of the 'No Access' role.
   • BIt makes it difficult to manage and audit permissions as the number of users grows.
   • CIt increases the risk of privilege escalation.
   • DIt is not supported by vCenter Server.
   Reveal Solution Discussion Select an answer first
5. 9application · easy

   A vSphere administrator is designing the RBAC strategy for a new environment. The company has a large number of users who need varying levels of access to different resources. The administrator wants to minimize administrative overhead and ensure that access is easy to manage. What is the BEST practice for assigning permissions?

   • AAssign permissions directly to individual users on the specific objects they need to access.
   • BUse the Administrator role for all users to simplify management.
   • CCreate a single custom role with all privileges and assign it to all users.
   • DCreate a role for each job function and assign the role to the appropriate group on the relevant inventory objects.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A vSphere administrator needs to create a role for the 'network-team' that allows them to create, modify, and delete standard virtual switches and port groups, but NOT to manage physical NICs or uplinks. The administrator wants to base this on an existing role to save time. What is the most efficient way to create this role?

   • AClone the 'Network administrator' role and then remove the privileges related to physical NIC management.
   • BAssign the 'network-team' group the 'Network administrator' role on the hosts and remove the group from the 'Administrators' group.
   • CCreate a new role from scratch and manually select the 'Host > Configuration > Networking' privileges.
   • DCreate a new role and select the 'Host > Configuration > Network configuration' privilege only.
   Reveal Solution Discussion Select an answer first